🐛 Preserve tar symlinks on Python 3.14

buildozer/buildops.py

@@ -122,8 +122,11 @@ def file_extract(archive, env, cwd="."):
         for extension in (".tgz", ".tar.gz", ".tbz2", ".tar.bz2")
     ):
         LOGGER.debug("Extracting {0} to {1}".format(archive, cwd))
+        extract_kwargs = {}
+        if hasattr(tarfile, "fully_trusted_filter"):
+            extract_kwargs["filter"] = "fully_trusted"
         with tarfile.open(path, "r") as compressed_file:
-            compressed_file.extractall(cwd)
+            compressed_file.extractall(cwd, **extract_kwargs)
         return
 
     if path.suffix == ".zip":

tests/test_buildops.py

@@ -1,4 +1,5 @@
-from os import environ, unlink
+import io
+from os import environ, readlink, unlink
 from pathlib import Path
 import tarfile
 from queue import Queue
@@ -284,6 +285,43 @@ def test_extract_file(self):
                 assert uncompressed_file.read() == "Text to tgz"
             m_logger.reset_mock()
 
+    @skipIf(platform == "win32", "Symlinks require admin on Windows")
+    def test_extract_tarball_preserves_symlinks(self):
+        with mock.patch(
+            "buildozer.buildops.LOGGER"
+        ) as m_logger, TemporaryDirectory() as base_dir:
+            m_logger.log_level = 2
+            m_logger.INFO = 1
+
+            tarfile_path = Path(base_dir) / "symlinks.tgz"
+            with tarfile.open(tarfile_path, "x:gz") as outfile:
+                payload = b"target content"
+                target_info = tarfile.TarInfo("target.txt")
+                target_info.size = len(payload)
+                outfile.addfile(target_info, io.BytesIO(payload))
+
+                rel_info = tarfile.TarInfo("rel_link")
+                rel_info.type = tarfile.SYMTYPE
+                rel_info.linkname = "target.txt"
+                outfile.addfile(rel_info)
+
+                abs_info = tarfile.TarInfo("abs_link")
+                abs_info.type = tarfile.SYMTYPE
+                abs_info.linkname = "/etc/hostname"
+                outfile.addfile(abs_info)
+
+            buildops.file_extract(tarfile_path, environ, cwd=base_dir)
+
+            assert (Path(base_dir) / "target.txt").is_file()
+
+            rel_path = Path(base_dir) / "rel_link"
+            assert rel_path.is_symlink()
+            assert readlink(rel_path) == "target.txt"
+
+            abs_path = Path(base_dir) / "abs_link"
+            assert abs_path.is_symlink()
+            assert readlink(abs_path) == "/etc/hostname"
+
     def test_cmd_unicode_decode(self):
         """
         Verifies cmd() can properly handle non-unicode outputs.